The SafePay advisory gives critical infrastructure operators a bounded set of facts to act on. The actors have affected at least 600 organizations since August 2024, use valid accounts and exposed remote access, exploit five named CVEs, and may delete or reset recovery systems. A 30-day plan cannot remove every risk, but it can create a defensible inventory, close the most exposed paths and establish evidence for the next review.
Days 1 to 3: establish the public entry list
Collect public addresses from firewalls, cloud accounts, DNS and the asset inventory. Reconcile the list with the five named products: Cisco ASA/FTD, Veeam Backup & Replication and SonicWall SonicOS. Record the owner, business service, management interface, VPN path and backup role for each asset.
Use ZoomEye as an observation source with a narrow scope. On October 31, 2026, service="rdp" returned 16,549,923 all-asset observations, vul.cve="CVE-2024-40766" returned 93,209, app="SonicWall" returned 2,513,927 and app="Cisco ASA" returned 113. The two Cisco CVE queries each returned 1,106,652 observations, while both Veeam CVE queries and the Veeam product query returned 0. These are different measurements, not victim counts or proof of vulnerable builds.
The first deliverable is a tiered list. Tier A contains public remote access and management interfaces with an unknown version or unmanaged owner. Tier B contains systems with a known product but unverified configuration. Tier C contains assets with a current verified baseline. Mark every exception and assign a deadline.
Days 4 to 10: prove the patch state
Compare installed versions with the Cisco, Veeam and SonicWall advisories. For Cisco, verify both ASA/FTD release and the relevant web services or VPN configuration. For Veeam, check the backup server and any dependent components against the fixed releases. For SonicWall, verify the exact SonicOS build and the management and SSLVPN settings.
Capture the version before and after the update. Confirm standby nodes, appliances and cloud images. Test the service after the reboot. Remove temporary management exposure when the change is complete. If a fix cannot be applied immediately, document the compensating control and the date it will be rechecked.
Days 11 to 20: reduce access paths
Review every account that can reach a remote administration interface. Remove dormant accounts, split administrative roles and revoke long-lived sessions. Require MFA at the identity provider and at the remote-access gateway where supported. Restrict management access to approved sources and log successful as well as failed authentication.
Segment backup administration from ordinary user networks. Validate that a compromised workstation account cannot reach the backup console or NAS management interface. Test one immutable or offline restore without relying on the primary identity provider. Record the result, including the time and scope restored.
Days 21 to 30: test the detection path
Create a small set of high-value alerts: new remote administration from an unusual device, a privilege change followed by a backup-policy change, deletion of restore points and a large outbound transfer from a sensitive data store. Route the alerts to an owner who can respond during the organization's operating hours.
Run a tabletop exercise based on the advisory. Start with a VPN login from a commercial address, add a valid account, move through RDP and attempt to reach backup infrastructure. The exercise should produce decisions, not only observations. Who isolates the host? Who revokes the session? Who contacts the backup team? Who preserves evidence for legal and regulatory review?
Close with evidence
At the end of the month, report the number of public entry points removed, the number of named-product assets with verified versions, the number of privileged accounts reduced and the result of the restore test. Keep the unknowns visible. A current list with two unknown appliances is more useful than a polished dashboard that hides them.
SafePay's reported use of valid accounts and its ability to disrupt backups make the combination of exposure reduction, identity control and recovery testing necessary. The plan works when each remaining public path has an owner, a current patch state and a tested response. That is the evidence a critical infrastructure operator can defend.